deepagents-code 0.1.62__tar.gz → 0.1.63__tar.gz

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/AGENTS.md

@@ -153,8 +153,8 @@ To add a new slash command: (1) add a `SlashCommand` entry to `COMMANDS`, (2) se
 
 1. `deepagents_code/model_config.py` — add `"provider_name": "ENV_VAR_NAME"` to `PROVIDER_API_KEY_ENV`
 2. `deepagents_code/model_config.py` — if the provider reads a *dedicated* endpoint env var, add `"provider_name": ("CANONICAL_BASE_URL", "ALTERNATE", ...)` to `PROVIDER_BASE_URL_ENV` (see guidelines below); omit the provider entirely when it has no provider-specific endpoint variable
-3. `pyproject.toml` — add `provider = ["langchain-provider>=X.Y.Z,<N.0.0"]` to `[project.optional-dependencies]` and include it in the `all-providers` composite extra
-4. `deepagents_code/model_config.py` — add `"provider_name"` to `RETRY_PARAM_BY_PROVIDER` if the provider's chat model accepts `max_retries`
+3. `deepagents_code/model_config.py` — add `"provider_name": "max_retries"` (or the provider's actual retry-count constructor kwarg) to `RETRY_PARAM_BY_PROVIDER`. dcode's model-node middleware owns the retry budget, so this entry is the disable-list that forces the provider's own SDK retry loop off; omitting it lets the SDK retries multiply the middleware's attempts. Verify the kwarg name against the integration's constructor — leave the provider out only when it exposes no integer retry-count kwarg. Check what the kwarg counts: retries are disabled with the default zero, but a kwarg counting *total attempts* needs an entry in `RETRY_DISABLE_VALUE_BY_PROVIDER` (see `google_genai`), because zero attempts either restores the SDK default or is coerced back to one
+4. `pyproject.toml` — add `provider = ["langchain-provider>=X.Y.Z,<N.0.0"]` to `[project.optional-dependencies]` and include it in the `all-providers` composite extra
 5. `deepagents_code/tui/widgets/auth.py` — add `"provider_name": "Display Name"` to `PROVIDER_DISPLAY_NAMES` so the `/auth` UI shows a branded label instead of the title-cased key, and (if the provider issues API keys from a self-serve page) `"provider_name": "https://…"` to `PROVIDER_API_KEY_URLS` so the prompt links straight to the key page
 6. `tests/unit_tests/test_model_config.py` — add `assert PROVIDER_API_KEY_ENV["provider_name"] == "ENV_VAR_NAME"` to `TestProviderApiKeyEnv.test_contains_major_providers`, and pin any `PROVIDER_BASE_URL_ENV` entry with a matching assertion
 

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.63](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.62...deepagents-code==0.1.63) (2026-08-26)
+
+### Features
+
+- Added Baseten `zai-org/GLM-5.3-Flash` to the model switcher ([#5844](https://github.com/langchain-ai/deepagents/issues/5844)).
+- Added support for loading managed config from a remote source ([#5776](https://github.com/langchain-ai/deepagents/issues/5776)).
+- Added retry middleware for transient model errors in model nodes ([#4569](https://github.com/langchain-ai/deepagents/issues/4569)).
+
+### Fixes
+
+- Fixed live cost tracking for dynamic subagents ([#5833](https://github.com/langchain-ai/deepagents/issues/5833)).
+- Improved `clear` command descriptions ([#5841](https://github.com/langchain-ai/deepagents/issues/5841)).
+- Allowed instrumental Auto actions ([#5832](https://github.com/langchain-ai/deepagents/issues/5832)).
+- Ensured traces are flushed before server shutdown ([#5837](https://github.com/langchain-ai/deepagents/issues/5837)).
+- Made the debug log path click-to-copy ([#5845](https://github.com/langchain-ai/deepagents/issues/5845)).
+
 ## [0.1.62](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.61...deepagents-code==0.1.62) (2026-08-26)
 
 ### Features

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/COMMANDS.md

@@ -17,7 +17,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/auto` |  | Switch to Auto approval mode or manage its classifier model |
 | `/auto-update` |  | Turn automatic updates on or off |
 | `/changelog` |  | Open the changelog in a browser |
-| `/clear` |  | Clear the chat and start a new thread |
+| `/clear` |  | Start a fresh thread |
 | `/context` |  | Show current context window usage |
 | `/context-doctor` |  | Audit what a session injects and its estimated token cost |
 | `/copy` |  | Copy the latest assistant message to clipboard |
@@ -26,7 +26,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/editor` |  | Open prompt in an external editor ($EDITOR) |
 | `/effort` |  | Set reasoning effort for the current model |
 | `/feedback` |  | Send feedback or report an issue |
-| `/force-clear` |  | Stop active work, clear the chat, and start a new thread |
+| `/force-clear` |  | Recover a stuck session with a fresh thread |
 | `/goal` |  | Set and manage a persistent objective with acceptance criteria |
 | `/help` |  | Show help and available commands |
 | `/install` |  | Install an optional integration |

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.62
+Version: 0.1.63
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/THREAT_MODEL.md

@@ -333,11 +333,17 @@
   - A missing file is accepted and applies no policy.
   - A present unreadable, undecodable, or syntactically corrupt file blocks every command except `--help`, `--version`, `help`, `config`, `doctor`, and `auth path`. It also blocks `/reload`.
   - On Windows, a ProgramData directory that cannot be read from the registry blocks the same commands. The path would be a guess, and an empty read at a guessed path does not prove that no policy is deployed. Reporting it as a missing file made every managed setting silently inert on a host whose ProgramData is relocated.
-  - A failed `/reload` keeps the last snapshot that parsed cleanly, so policy is never dropped mid-session.
+  - A failed `/reload` keeps the last enforceable snapshot, so policy is never dropped mid-session. A snapshot that parses but cannot be enforced is not cached either, so a rejected edit cannot become the generation later readers observe.
   - An unusable user `config.toml` drops only the user layer, so managed policy still applies.
   - A deny list that cannot be read is treated as denying everything, never as empty. This covers a managed `[mcp].disabled_servers` that is neither an array of names nor a comma-separated string, and a `[mcp]` section that is not a table. A managed `[mcp].enabled_project_server_approvals` that is not an array is treated the same way: the key is present, so policy means to narrow access, and reading its presence as absence would keep both the user's approvals and the `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
 - **Outside**: Ownership, permission-mode validation, privileged installation, and `sudo` policy are deployment responsibilities. Anyone who can replace the administrator-managed file can control model, sandbox, interpreter, MCP trust, and other supported runtime settings. Model policy constrains official dcode selection and construction paths; it does not stop a hostile local user from replacing the package, modifying the process, or calling a provider SDK directly. On macOS, note that stock `/Library/Application Support` is group-writable by `admin`, so any admin-group member can create the file and grant themselves policy. Deployments that rely on this boundary must tighten ownership and mode on the `dcode` directory.
-- **Crossing mechanism**: Synchronous local file read through `configuration.TomlFileProvider`, followed by typed resolution and CLI/server startup gates.
+- **Remote source**: The fixed local file may contain only `[managed_config].source`. Its administrator-owned HTTPS URL is then the explicit destination allowlist. The remote document becomes the whole managed policy. It cannot chain to another source. URLs with userinfo, query strings, or fragments are rejected. So are URLs carrying whitespace, control characters, or any non-ASCII character: confusable host text must not reach operator output, and `urllib` does not encode a non-ASCII request target consistently.
+  - Requests validate the certificate against Python's default TLS trust store, bypass environment proxies, and refuse redirects. One five-second budget covers the whole fetch: the connection, the TLS handshake, the headers, and the body. The fetch is abandoned once that budget is spent. At most 1 MiB is accepted.
+  - Only a complete document is accepted. The status must be 200. The media type must be `application/toml`, `text/plain`, or `application/octet-stream`, and the body must not be compressed. A captive portal or gateway error page that answers 200 with `text/html` is rejected before it is parsed. This is not a complete guard, and it is not relied on as one: a response with no `Content-Type`, or one claiming `application/octet-stream`, is read, because a bare object store answers that way. Such a body still has to parse as TOML and satisfy every rule below. Framing must show the body arrived whole: one matching `Content-Length`, or chunked encoding. A response that sends both, or that repeats `Content-Length` with different values, is rejected — the first value wins in `http.client`, so a duplicate header would otherwise let a prefix pass as a whole document. A keyless document is rejected as a failed publish. Truncated TOML often still parses, so a partial document would otherwise enforce a policy with entries silently missing, and would replace the last enforceable generation.
+  - The proxy bypass stops a local user redirecting the fetch through `HTTPS_PROXY`. The trust store itself is not pinned. `SSL_CERT_FILE` and `SSL_CERT_DIR` still select the certificate authorities, so the same actor can substitute the CA set for this request. This is the same deployment responsibility as the local file ownership in the **Outside** bullet above. This boundary does not apply on a host where an unprivileged user controls the `dcode` process environment.
+  - No disk cache or authentication material is stored. Private enterprise hosts remain reachable because the local trust anchor, not user input, selects the host. A fetch failure stops startup. A failed reload keeps the process's last enforceable snapshot, and `dcode doctor` reports that the refresh failed so a host that stopped answering is not silent.
+
+- **Crossing mechanism**: Synchronous local file read through `configuration.TomlFileProvider`, optionally followed by one bounded HTTPS fetch through `configuration.RemoteTomlProvider`, then typed resolution and CLI/server startup gates.
 
 #### TB14: Launch Environment → User Trust Root
 

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "dc27a2f"
+BUILD_COMMIT = "970003e"

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/deepagents_code/_server_config.py

@@ -254,6 +254,9 @@ class ServerConfig:
     """Extra kwargs forwarded to the chat model constructor (temperature,
     max_tokens, etc.)."""
 
+    cli_max_retries: int | None = None
+    """Explicit `--max-retries` value, separate from provider model kwargs."""
+
     profile_overrides: dict[str, Any] | None = None
     """Model profile metadata overrides resolved by the client."""
 
@@ -424,6 +427,12 @@ class ServerConfig:
         if self.rubric_max_iterations is not None and self.rubric_max_iterations <= 0:
             msg = "rubric_max_iterations must be None or a positive integer"
             raise ValueError(msg)
+        if isinstance(self.cli_max_retries, bool):
+            msg = "cli_max_retries must be None or a non-negative integer"
+            raise TypeError(msg)
+        if self.cli_max_retries is not None and self.cli_max_retries < 0:
+            msg = "cli_max_retries must be None or a non-negative integer"
+            raise ValueError(msg)
         if isinstance(self.recursion_limit, bool):
             msg = "recursion_limit must be None or a positive integer"
             raise TypeError(msg)
@@ -451,6 +460,9 @@ class ServerConfig:
             "MODEL_PARAMS": (
                 json.dumps(self.model_params) if self.model_params is not None else None
             ),
+            "MAX_RETRIES": (
+                str(self.cli_max_retries) if self.cli_max_retries is not None else None
+            ),
             "PROFILE_OVERRIDES": (
                 json.dumps(self.profile_overrides)
                 if self.profile_overrides is not None
@@ -522,6 +534,7 @@ class ServerConfig:
         return cls(
             model=_read_env_str("MODEL"),
             model_params=_read_env_json("MODEL_PARAMS"),
+            cli_max_retries=_read_env_int("MAX_RETRIES", default=None),
             profile_overrides=_read_env_json("PROFILE_OVERRIDES"),
             assistant_id=_read_env_str("ASSISTANT_ID") or DEFAULT_ASSISTANT_ID,
             system_prompt=_read_env_str("SYSTEM_PROMPT"),
@@ -570,6 +583,7 @@ class ServerConfig:
         project_context: ProjectContext | None,
         model_name: str | None,
         model_params: dict[str, Any] | None,
+        cli_max_retries: int | None = None,
         profile_overrides: dict[str, Any] | None = None,
         assistant_id: str,
         auto_approve: bool,
@@ -604,6 +618,7 @@ class ServerConfig:
             project_context: Explicit user/project path context.
             model_name: Model spec string.
             model_params: Extra model kwargs.
+            cli_max_retries: Explicit `--max-retries` value.
             profile_overrides: Model profile metadata overrides.
             assistant_id: Agent identifier.
             auto_approve: Auto-approve all tools.
@@ -650,6 +665,7 @@ class ServerConfig:
         return cls(
             model=model_name,
             model_params=model_params,
+            cli_max_retries=cli_max_retries,
             profile_overrides=profile_overrides,
             assistant_id=assistant_id,
             auto_approve=auto_approve,

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/deepagents_code/_session_stats.py

@@ -30,17 +30,13 @@ logger = logging.getLogger(__name__)
 _warned_usage_stats_rejections: set[str] = set()
 """Rejection reasons already reported by `_warn_rejected_usage_stats_value`."""
 
-SpinnerStatus = (
-    Literal[
-        "Thinking",
-        "Offloading",
-        "Loading thread",
-        "Drafting acceptance criteria",
-        "Reviewing approval request",
-    ]
-    | None
-)
-"""Valid spinner display states, or `None` to hide."""
+SpinnerStatus = str | None
+"""Spinner display text, or `None` to hide.
+
+Deliberately unconstrained rather than the closed `Literal` set it replaced:
+retry status text is generated per attempt by `model_retry.format_retry_status`.
+Narrowing this back to a `Literal` union would break the retry spinner.
+"""
 
 UsageKind = Literal["assistant", "subagent", "offload", "auto"]
 """Billing/display class for a model request."""
@@ -892,6 +888,108 @@ def record_message_usage(
     )
 
 
+def is_model_usage_event(data: object) -> bool:
+    """Report whether a custom-stream payload is a nested model-usage event.
+
+    Lets a client consume its own event whatever `record_model_usage_event` made
+    of it. A duplicate of a request the message stream already recorded is still
+    this client's event, not a payload for the unrelated handlers downstream.
+
+    Args:
+        data: A `custom` stream payload.
+
+    Returns:
+        `True` when the payload claims to be a nested model-usage event.
+    """
+    from deepagents_code.cost_tracking import MODEL_USAGE_EVENT_TYPE
+
+    return isinstance(data, Mapping) and data.get("type") == MODEL_USAGE_EVENT_TYPE
+
+
+def record_model_usage_event(
+    stats: SessionStats,
+    data: object,
+    *,
+    active_thread_id: str = "",
+    fallback_model: str = "",
+    fallback_provider: str = "",
+    recorded_requests: dict[str, RecordedRequest] | None = None,
+) -> RecordedUsage | None:
+    """Record a validated provisional usage event from a nested model call.
+
+    Returns:
+        The recorded usage delta, or `None` when the event is invalid or duplicate.
+    """
+    from deepagents_code.cost_tracking import (
+        MODEL_USAGE_EVENT_TYPE,
+        MODEL_USAGE_EVENT_VERSION,
+    )
+
+    if not isinstance(data, Mapping) or data.get("type") != MODEL_USAGE_EVENT_TYPE:
+        return None
+    version = data.get("version")
+    if (
+        not isinstance(version, int)
+        or isinstance(version, bool)
+        or version != MODEL_USAGE_EVENT_VERSION
+    ):
+        # A newer graph process can stream a shape this client cannot read. The
+        # spend is still charged and streamed as the thread total, so only the
+        # provisional display is lost -- but silence would make that look like
+        # the graph never emitted anything.
+        logger.debug(
+            "Ignoring a nested usage event of version %r; this client reads %d.",
+            version,
+            MODEL_USAGE_EVENT_VERSION,
+        )
+        return None
+    request_id = data.get("request_id")
+    thread_id = data.get("thread_id")
+    scope = data.get("scope")
+    usage = data.get("usage_metadata")
+    model_name, provider = data.get("model_name"), data.get("provider")
+    if (
+        not isinstance(request_id, str)
+        or not request_id
+        or not isinstance(thread_id, str)
+        or not thread_id
+        or not isinstance(scope, str)
+        or not scope
+        or not isinstance(usage, Mapping)
+        or not usage
+        or not isinstance(model_name, str)
+        or not isinstance(provider, str)
+    ):
+        logger.debug("Ignoring a malformed nested usage event")
+        return None
+    if active_thread_id and thread_id != active_thread_id:
+        # Ordinary: a stream for a thread the user has since switched away from.
+        return None
+    try:
+        from langchain_core.messages import AIMessage
+
+        message = AIMessage(
+            content="",
+            id=request_id,
+            usage_metadata=cast("Any", dict(usage)),
+            response_metadata={
+                "model_name": model_name,
+                "model_provider": provider,
+            },
+        )
+    except (TypeError, ValueError):
+        logger.debug("Rejected malformed nested model usage", exc_info=True)
+        return None
+    return record_message_usage(
+        stats,
+        message,
+        fallback_model=fallback_model,
+        fallback_provider=fallback_provider,
+        kind="subagent",
+        recorded_requests=recorded_requests,
+    )
+
+
 def format_token_count(count: int) -> str:
     """Format a token count into a human-readable short string.
 

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.62"  # x-release-please-version
+__version__ = "0.1.63"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.62 → deepagents_code-0.1.63}/deepagents_code/agent.py

@@ -83,6 +83,7 @@ from deepagents_code.approval_mode import (
 )
 from deepagents_code.config import (
     _INHERITED_PYTHONPATH_ENV,
+    DEFAULT_MODEL_RETRIES,
     _ShellAllowAll,
     config,
     console,
@@ -2204,6 +2205,52 @@ def _apply_inherited_pythonpath(env: dict[str, str]) -> None:
         env["PYTHONPATH"] = inherited
 
 
+def _resolve_retry_owned_model(
+    model_spec: str, cli_max_retries: int | None
+) -> BaseChatModel | None:
+    """Resolve a string model with provider retries disabled and metadata tagged.
+
+    Only an explicit `--max-retries` is forwarded. Passing the caller's already
+    resolved budget instead would take precedence over
+    `[retries.<provider>].max_retries`, so a model on a different provider could
+    never use its own configured budget.
+
+    Args:
+        model_spec: The subagent's declared model string.
+        cli_max_retries: The `--max-retries` flag value, or `None` when unset.
+
+    Returns:
+        The concrete model prepared by dcode's model factory, or `None` when it
+        cannot be built here and the caller should pass the spec through.
+    """
+    from deepagents_code.config import create_model
+    from deepagents_code.model_config import MissingCredentialsError
+
+    try:
+        return create_model(model_spec, cli_max_retries=cli_max_retries).model
+    except MissingCredentialsError:
+        # Taking ownership of retries is an optimization, not a precondition for
+        # launching. A subagent declaring a provider the user has not
+        # authenticated must not abort the whole CLI: pass the spec through so
+        # the credential error surfaces if and when that subagent runs.
+        logger.debug(
+            "Deferring model resolution for %r: no provider credentials yet",
+            model_spec,
+        )
+        return None
+
+
+def _has_resolvable_model_provider(model_spec: str) -> bool:
+    """Return whether dcode can resolve the provider before graph construction."""
+    from deepagents_code.config import detect_provider
+    from deepagents_code.model_config import ModelSpec
+
+    return (
+        ModelSpec.try_parse(model_spec) is not None
+        or detect_provider(model_spec) is not None
+    )
+
+
 def get_skill_sources(
     assistant_id: str = DEFAULT_AGENT_NAME,
     project_context: ProjectContext | None = None,
@@ -2299,6 +2346,8 @@ def create_cli_agent(
     async_subagents: list[AsyncSubAgent] | None = None,
     goal_criteria_tools: Sequence[BaseTool | Callable[..., Any]] | None = None,
     rubric_grader_tools: Sequence[BaseTool | Callable[..., Any]] | None = None,
+    model_retries: int = DEFAULT_MODEL_RETRIES,
+    cli_max_retries: int | None = None,
     enforce_model_policy: bool = True,
 ) -> tuple[Pregel[Any, Any, Any, Any], CompositeBackend]:
     """Create a CLI-configured agent with flexible options.
@@ -2448,6 +2497,12 @@ def create_cli_agent(
         rubric_grader_tools: External read-only context tools available to rubric
             grading for verifying work completed in MCP-backed or web-accessible
             systems.
+        model_retries: Model-node retry attempts after the first call. `0`
+            disables retries. Resolved upstream from config/CLI.
+        cli_max_retries: The `--max-retries` flag value, or `None` when unset.
+            Forwarded to subagent, Auto classifier, and runtime offload models
+            so each one resolves its own provider's configured budget unless the
+            user overrode it globally.
         enforce_model_policy: Check every model string against `models.allowed`.
             Pass `False` **only** from callers that compile a graph they never
             invoke (tool enumeration), so a blocked subagent model degrades the
@@ -2468,10 +2523,9 @@ def create_cli_agent(
             without `auto_approve` or `interpreter_ptc_acknowledge_unsafe`.
         ModelNotAllowedError: When `model`, `auto_classifier_model`,
             `rubric_model`, or a subagent's frontmatter `model` is a string
-            outside the effective `models.allowed` policy. Model *strings* are
-            checked here because the SDK resolves them through
-            `init_chat_model`, bypassing `config.create_model`; a prebuilt
-            `BaseChatModel` came from a path that already checked.
+            outside the effective `models.allowed` policy. Model strings are
+            checked before dcode resolves them with provider retries disabled;
+            a prebuilt `BaseChatModel` came from a path that already checked.
     """  # noqa: DOC502 - propagates from `ModelConfig.require_model_allowed`
     tools = tools or []
     mcp_tools = tuple(mcp_tools or ())
@@ -2542,7 +2596,12 @@ def create_cli_agent(
         if resolved_interrupt_on is not None:
             middleware.append(AsyncApprovalHITLMiddleware(resolved_interrupt_on))
         if not has_explicit_model:
-            middleware.append(ConfigurableModelMiddleware(persist_model_state=False))
+            middleware.append(
+                ConfigurableModelMiddleware(
+                    persist_model_state=False,
+                    cli_max_retries=cli_max_retries,
+                )
+            )
         # Checkpoint nested spend before HITL can pause the subgraph, then hand
         # the completed delta back through owner-scoped state for the parent
         # graph to add to its durable total.
@@ -2552,6 +2611,9 @@ def create_cli_agent(
         # activates only for the measured Fireworks GLM-5.2 endpoint.
         if not interactive:
             middleware.append(_GlmTerminalStallRecovery())
+        from deepagents_code.model_retry import CodeModelRetryMiddleware
+
+        middleware.append(CodeModelRetryMiddleware(max_retries=model_retries))
         if restrictive_shell_allow_list is not None:
             middleware.append(ShellAllowListMiddleware(restrictive_shell_allow_list))
         # Server-owned hooks must wrap subagent tools too; otherwise Pre/Post
@@ -2585,9 +2647,12 @@ def create_cli_agent(
     from deepagents_code._cli_context import INHERIT_CLASSIFIER_MODEL
     from deepagents_code.model_config import ModelConfig
 
-    # Every model *string* this function forwards is checked here, because the
-    # SDK resolves strings through `init_chat_model` without passing through
-    # `create_model` -- the gate in `config.create_model` never sees them. A
+    # Every runtime model string is checked before it is resolved. Known providers
+    # go through `create_model` here so the SDK retry loop is disabled before Deep
+    # Agents builds the graph and every request carries dcode's retry metadata.
+    # Graph-only tool enumeration leaves all strings to SDK assembly because it
+    # never invokes them. Provider-less placeholders also remain strings because
+    # dcode cannot identify a retry constructor parameter for them. A
     # `BaseChatModel` was already built by a checked path, so it is exempt.
     model_policy = ModelConfig.load()
     if not enforce_model_policy:
@@ -2601,6 +2666,12 @@ def create_cli_agent(
         )
     if isinstance(model, str):
         model_policy.require_model_allowed(model)
+        if enforce_model_policy and _has_resolvable_model_provider(model):
+            # `None` means credentials are absent: keep the spec so graph
+            # construction resolves it later instead of failing the launch.
+            resolved = _resolve_retry_owned_model(model, cli_max_retries)
+            if resolved is not None:
+                model = resolved
     if (
         isinstance(auto_classifier_model, str)
         and auto_classifier_model.strip()
@@ -2637,7 +2708,14 @@ def create_cli_agent(
                     else f"subagent {name!r}"
                 ),
             )
-            subagent["model"] = model_spec
+            resolved_model = (
+                _resolve_retry_owned_model(model_spec, cli_max_retries)
+                if enforce_model_policy and _has_resolvable_model_provider(model_spec)
+                else None
+            )
+            subagent["model"] = (
+                resolved_model if resolved_model is not None else model_spec
+            )
         subagent_middleware = _subagent_cli_middleware(
             has_explicit_model=has_explicit_model,
         )
@@ -2673,7 +2751,7 @@ def create_cli_agent(
 
     # Build middleware stack based on enabled features
     agent_middleware: list[AgentMiddleware[Any, Any]] = [
-        ConfigurableModelMiddleware(),
+        ConfigurableModelMiddleware(cli_max_retries=cli_max_retries),
     ]
     if not interactive:
         agent_middleware.append(_GlmTerminalStallRecovery())
@@ -2935,7 +3013,11 @@ def create_cli_agent(
             routes={},
         )
 
-    compaction_middleware = _create_cli_compaction_middleware(model, composite_backend)
+    compaction_middleware = _create_cli_compaction_middleware(
+        model,
+        composite_backend,
+        cli_max_retries=cli_max_retries,
+    )
     if auto_mode_config is not None and resolved_interrupt_on is not None:
         from deepagents_code.auto_mode import AutoModeHITLMiddleware
         from deepagents_code.config import resolve_auto_classifier_model
@@ -2956,6 +3038,7 @@ def create_cli_agent(
                 worktree_root=trusted_root,
                 shell_allow_list=narrow_allow_list,
                 classifier_model=classifier_model,
+                cli_max_retries=cli_max_retries,
                 classifier_timeout_seconds=resolve_auto_classifier_timeout(),
                 trusted_ask_user_tool=trusted_ask_user_tool,
                 trusted_compaction_tool=compaction_middleware.tools[0],
@@ -3049,14 +3132,29 @@ def create_cli_agent(
             context_tools=goal_criteria_tools,
             auto_mode_enabled=auto_mode_enabled,
             fs_tools=fs_tools,
+            model_retries=model_retries,
+            cli_max_retries=cli_max_retries,
+        )
+        criteria_fallback_agent = create_goal_criteria_fallback_agent(
+            model=model,
+            model_retries=model_retries,
+            cli_max_retries=cli_max_retries,
         )
-        criteria_fallback_agent = create_goal_criteria_fallback_agent(model=model)
         agent_middleware.append(
             GoalCriteriaMiddleware(criteria_agent, criteria_fallback_agent)
         )
 
     agent_middleware.append(compaction_middleware)
 
+    # Model-node retry sits inside side-effecting automatic compaction so a
+    # failed provider attempt repeats only the final model handler, not summary
+    # generation or the archive append. Keep it in the stack when the startup
+    # budget is zero because a runtime `/model` switch may select a provider
+    # with a non-zero request-time budget.
+    from deepagents_code.model_retry import CodeModelRetryMiddleware
+
+    agent_middleware.append(CodeModelRetryMiddleware(max_retries=model_retries))
+
     grader_context_tools = _normalize_rubric_grader_context_tools(
         rubric_grader_tools or ()
     )
@@ -3097,6 +3195,12 @@ def create_cli_agent(
     )
 
     grader_middleware: list[AgentMiddleware[Any, Any]] = [
+        # Both clients filter this nested message stream. A transient fault can
+        # safely retry the failed model node without replaying grader tools.
+        CodeModelRetryMiddleware(
+            max_retries=model_retries,
+            stream_output_is_visible=False,
+        ),
         _ContextToolCallBudgetMiddleware(
             # `read_file` is bounded separately by the grader's in-tool
             # working-directory counter, which excludes offloaded-result reads.
@@ -3131,6 +3235,12 @@ def create_cli_agent(
     # a policy check here would instead advise a fully qualified spec.
     if isinstance(rubric_model, str) and rubric_model.strip():
         model_policy.require_model_allowed(rubric_model)
+        if enforce_model_policy and _has_resolvable_model_provider(rubric_model):
+            resolved_rubric_model = _resolve_retry_owned_model(
+                rubric_model, cli_max_retries
+            )
+            if resolved_rubric_model is not None:
+                rubric_model = resolved_rubric_model
 
     # Rubric-driven self-evaluation. The middleware is a no-op until a
     # `rubric` is supplied on invocation state, so installing it is safe.